ARTEX and the Arrival of AI-Orchestrated Attacks: What the Network Sees

ARTEX, an LLM-driven autonomous penetration testing framework, went from a public GitHub project to a threat actor toolkit in under three months. CrowdStrike, Microsoft and CERT-EU have tied ARTEX to intrusions at banks, foreign ministries, telecom providers and a major IT management vendor. As of November 9th, Censys counts 1,465 internet-exposed ARTEX consoles worldwide.

Beyond raw console counts, ARTEX represents an inflection point. AI-orchestrated attacks have moved from a topic of discussion at security conferences into real intrusions against real organizations. ExtraHop CEO Greg Clark describes the attack sequence behind ARTEX and other AI-orchestrated intrusions: "It's layer 7 credential abuse followed by a beachhead, and an LLM doing the control and exploit generation. What the industry feared is indeed happening, and AI-orchestrated attacks are adaptively evading traditional defenses."

Defenders still hold one structural advantage against an AI-driven adversary. Every autonomous agent has to use the network to scan, authenticate, move laterally and establish command-and-control. Each of those phases leaves an immutable trace on the wire. The analysis below briefly summarizes threat intelligence on ARTEX, then details the network behavior that ARTEX workflows produce and what network context uncovers at each step.

What is ARTEX?

ARTEX is an open-source, LLM-driven autonomous penetration testing framework. A developer known as Autumn-27 released ARTEX on GitHub in July of 2026. The framework takes an objective written in plain language and breaks the objective into goals. Agent workers then run real offensive tools against the target to reach each goal. A human operator watches and steers the work through a web console (CERT-EU).

ARTEX ships without its own AI model. Operators plug in whichever LLM they choose, and recent campaigns used DeepSeek, GLM and commercial models. The original author pulled the repository in October of 2026, after widespread abuse. Independent forks still circulate, including a localized variant called ScopeWeaver and a commercial version called ARTEX PRO (Google Threat Intelligence Group).

Who is using ARTEX?

ARTEX builds on the AI-orchestrated attack pattern that ExtraHop documented in Two Cloud Breaches Show How AI Is Compressing the Attack Timeline. In the July 2026 intrusion, a lone adversary used AI to run reconnaissance, access, exfiltration and takeover concurrently, compressing the entire breach into three days. ARTEX packages the same approach into a framework anyone can download. Since late August of 2026, the Google Threat Intelligence Group has documented ARTEX in breaches led by both financially motivated extortion groups and suspected state-backed operators. Public reporting names at least four ARTEX operations:

• VAPOR PANDA: A China-nexus espionage group deployed ARTEX against more than 200 organizations in at least 14 countries over an 11-day period. Targets included foreign ministries, telecom providers, and U.S. pharmaceutical, semiconductor and defense firms (CrowdStrike).
• Storm-0940: A China-aligned actor used ARTEX in a supply chain compromise of ConnectWise customer tenants (Microsoft).
• An unattributed, financially motivated actor: The actor breached South Korean financial institutions between late September and early October of 2026 and exfiltrated data (CrowdStrike).
• Crafty Falcon: India's CERT-In warned that the group targeted financial and cryptocurrency firms with ARTEX and other AI attack tools (Infosecurity Magazine).

How widespread is ARTEX?

In early November 2026, Censys found 1,465 internet-facing hosts, meaning individual IP addresses, serving an ARTEX console. About 650 of those hosts sit in two hosting providers' networks and share identical configurations. Censys assesses that pattern as a few servers cloned or aliased across hundreds of addresses. Setting those hosts aside leaves roughly 815 distinct deployments: separate ARTEX installations rather than copies of one server template. Censys also found ARTEX hosts running Cobalt Strike, tunneling tools, and other AI attack frameworks. Censys researcher Silas Cutler summarized the pattern: "Operators appear to be using multiple agent frameworks side by side."

Who is at risk?

Any organization operating internet-facing applications, VPNs, Active Directory or cloud workloads is a viable target. ARTEX tests large numbers of low-severity misconfigurations that human testers skip under tight engagement windows and manual effort limits. CERT-EU warns that ARTEX strings isolated configuration flaws together into higher-impact attack paths. Confirmed victims so far include government, financial services, pharmaceutical, semiconductor, defense and telecom organizations.

How does ARTEX work?

ARTEX runs a main agent that directs planner and worker agents over a shared graph of facts, findings, and goals. Each engagement moves from initial access through host reconnaissance to lateral movement. The human operator steps in only at decision points (CrowdStrike).

ARTEX connects to module plug-ins and to multiple local or cloud-based LLMs, and runs each task in a continuous decision-making loop. The framework handles basic Bash scripting itself. Resource-intensive tasks go to a companion component called ScopeSentry, built by the same developer.

Recovered transcripts from the VAPOR PANDA campaign show the workflow in practice:

• Cloud credential theft: At a U.S. pharmaceutical company, the agent chained an unsigned SAML assertion with an XML external entity (XXE) flaw. The chain let the agent query the cloud instance metadata service and steal a role with command rights over thousands of instances.
• Active Directory takeover: At a second pharmaceutical company, the agent deployed web shells and gained root in a container environment. The agent then read LAPS passwords and abused resource-based constrained delegation to impersonate a privileged account.
• Stolen keys and VPN access: At a Greek government entity, the agent used unrotated keys from a 2022 mail server export to forge an administrator token. VPN configurations found in sent mail then gave the agent a path into the internal network.

The operator also told the agents to find Windows machines without the CrowdStrike Falcon sensor, using tasklists and folder listings. Endpoint coverage checks became one more automated step in the workflow. Mapping EDR coverage first lets the agent steer its riskiest follow-on activity to hosts where no EDR tool exists, increasing the attack's odds of going undetected.

Instead of probing one foothold at a time, ARTEX agents execute across several attack vectors in parallel. CrowdStrike observed agents pursuing web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure concurrently, moving laterally and switching paths whenever an attempt failed. Most of the traffic across the targeted infrastructure flows over encrypted channels. HTTPS carries the web exploitation and web shells, Kerberos and LDAP carry the Active Directory abuse, and VPN sessions plus Chisel and SoftEther tunnels carry remote access and command-and-control. Encryption hides the multi-vector movement from any tool that cannot read inside the sessions, a point that the decryption section below covers in detail.

Familiar techniques at machine tempo

Every technique in the published ARTEX reporting already has a MITRE ATT&CK entry. Scanning, web exploitation, web shells, password spraying, delegation abuse and tunneling have filled attacker playbooks for years. ARTEX is part of a wider ecosystem of offensive AI tooling: Censys found ARTEX sharing hosts with CyberStrikeAI, PentAGI and HexStrike AI. ExtraHop has tracked the broader shift in AI Cyberattacks in 2026: 6 Breaches You Need to Know About and Cyber Attacks in the Age of AI.

AI orchestration upends five assumptions that defenders rely on:

• Parallelism: One VAPOR PANDA operator ran engagements against more than 200 organizations in 11 days, with planning agents consuming roughly 1.4 billion input tokens in a single intrusion.
• Thoroughness: Agents systematically test every low-severity misconfiguration and chain the findings into working attack paths.
• Persistence: Agents switch to an alternate path the moment an attempt fails, operating without fatigue.
• A lower skill bar: A single financially motivated actor breached multiple South Korean banks with ARTEX and commodity LLMs.
• Built-in evasion: Hunting for hosts without EDR is now a scripted task, and AI tooling can also extract on-host detection logic, a dynamic ExtraHop examines in AI Is Exposing EDR Defenses.

CERT-EU expects ARTEX's public availability to "accelerate adoption by threat actors, resulting in more frequent, faster, and scalable automated attacks with a higher success rate." Google Threat Intelligence Group assesses with high confidence that cybercrime actors will keep adopting autonomous offensive tools. Future frameworks will carry different names while executing the same underlying playbook. Detection that focuses on the behavior every framework must produce will outlast detection tied to a single tool's artifacts.

The network view: five places network traffic reveals ARTEX

ARTEX workflows leave network evidence at every stage. An agent can disable an endpoint sensor and clear a log, but the agent cannot move through an environment without generating traffic. ExtraHop turns that network traffic into real-time evidence for investigations. Four kinds of network evidence give defenders the clearest visibility into ARTEX activity: behavioral, asset, identity, and threat context. Real-time decryption maintains full visibility across all four evidence streams when traffic is encrypted. Combined, the telemetry layers are especially good at surfacing five core categories of ARTEX behavior:

1. Speed and volume: behavioral context

ARTEX's edge is running many attack paths in parallel. Parallel attack paths generate bursts of scanning, authentication attempts, and new east-west connections. Behavioral context supplies rolling baselines for every device and identity, so a host that suddenly probes dozens of services stands out immediately. In RevealX, real-time machine learning scores the activity as the activity happens, across more than 450 detectors mapped to more than 150 MITRE ATT&CK techniques.

ExtraHop threat researchers identified three traits that set ARTEX workflows apart: an unusually high volume of API calls, HTTP requests with unusual User-Agent strings, and extremely short intervals between attack techniques. Each trait shows up clearly against a behavioral baseline.

The more aggressively an operator runs ARTEX, the louder the network signal becomes. Machine-speed attacks produce machine-scale anomalies. In Expose Lateral Movement, ExtraHop explains how network-derived evidence reveals unauthorized movement across internal systems.

Where common defenses fall short: Perimeter firewalls and IDS sensors watch north-south traffic, so scanning and authentication bursts between internal servers never pass through perimeter inspection. SIEM correlation depends on individual hosts logging connection attempts and Windows servers leave inbound connection auditing disabled by default. Log pipelines also add ingest and query delay that a machine-speed attacker can outrun. ExtraHop's Two Cloud Breaches Show How AI Is Compressing the Attack Timeline explains why alert-by-alert triage loses that race.

2. Decryption: reading inside the traffic everyone treats as normal

Encrypted traffic is now the enterprise norm, giving attackers built-in cover for routine operations. Zscaler ThreatLabz found that more than 87% of threats arrive over encrypted channels. ARTEX's most important steps target protocols that modern environments encrypt by default, such as HTTPS, LDAP, SMB3 and WinRM, on servers inside the environment.

Network context is only as complete as the traffic behind it, leaving major blind spots whenever internal sessions stay encrypted. RevealX decrypts TLS 1.3 at line rate, including sessions protected by perfect forward secrecy, along with the Microsoft protocols attackers use to move laterally, including Kerberos, NTLM, LDAP, MS-RPC, SMBv3 and WinRM. Decryption turns an ambiguous encrypted session into readable evidence:

• XXE payloads and forged SAML assertions inside requests to web applications
• Web shell commands and the output the server sends back
• Exploit requests that point a web server at the cloud metadata address
• SMB and WinRM operations that create services, copy files or run remote commands

An analyst without decryption sees two hosts exchanging TLS traffic. An analyst with decryption sees the exploit, the shell, and the command. Decryption applies to servers the organization owns; traffic encrypted with attacker keys gets behavioral analysis instead, as described in section five. Learn more in Detecting Attacks Using Microsoft Protocol Decryption and Strategic Decryption.

Where common defenses fall short: Next Generation Firewall (NGFW) and secure web gateway decryption typically runs as an inline proxy for outbound user traffic. Inbound sessions to internal web applications usually stay encrypted, because inline interception adds latency and certificate management to production servers. Firewalls don’t have a way to decrypt the Microsoft encryption on Kerberos, LDAP and SMB3 at all. TLS 1.3 with perfect forward secrecy also rules out passive decryption with a server's private key. RevealX decrypts those sessions out-of-band using forwarded session keys, as Encryption vs. Visibility: Why SecOps Must Decrypt Traffic for Analysis explains.

3. Hosts without EDR: asset context

VAPOR PANDA explicitly directed ARTEX agents to find Windows machines without an EDR sensor. Unprotected hosts became the preferred place for follow-on activity. Specialized servers, network appliances, VPN concentrators, containers, IoT devices and legacy systems frequently operate without an endpoint agent.

Asset context is derived directly from the network itself, providing automatic visibility into every communicating host including unmanaged and unregistered devices. Out-of-band, agentless sensing eliminates local endpoint software that an attacker could disable and keeps detection logic off the host, out of reach of inspection or tampering. Every device that communicates on the network appears in RevealX, including devices absent from IT inventories. In the 2026 ExtraHop Global Threat Landscape Report, 49% of organizations reported failing to detect an intrusion until after data was stolen. See the Entire Attack Surface shows how network context discovers and monitors unmanaged assets.

Organizations that run CrowdStrike Falcon can turn that network visibility into automated response. The RevealX and CrowdStrike Falcon integration discovers endpoints that do not yet have a Falcon agent and can quarantine compromised devices automatically.

Where common defenses fall short: EDR consoles and asset inventories report on the hosts they already know about. An EDR console lists endpoints running a local agent while leaving uninstrumented servers, appliances, and containers completely unrecorded. CMDBs and periodic vulnerability scans drift out of date between cycles. ARTEX agents hunt for exactly specifically for unmonitored, unlisted hosts. AI Is Exposing EDR Defenses explains how attackers also study on-host detection rules to slip past them.

4. Active Directory attacks on the wire: identity context

Greg Clark's opening quote centers on credential abuse for good reason: ARTEX agents sprayed passwords, read LAPS passwords from Active Directory and abused resource-based constrained delegation to impersonate privileged accounts. Each technique travels over Kerberos, NTLM, or LDAP.

Identity context starts with inspecting authentication and directory traffic directly on the wire. RevealX decrypts and parses Kerberos, NTLM, and LDAP sessions, resolving the user identity into every associated activity record. Decrypted Kerberos traffic exposes the ticket details behind delegation abuse, such as the impersonated user and the target service. Correlating network activity with Active Directory and Microsoft Entra ID adds the identity context behind four investigation workflows:

• Start from a user and see every associated device, protocol and detection
• Spot one account authenticating to many hosts over SMB, NTLM, Kerberos or RDP
• Raise the priority of detections involving privileged accounts automatically
• Scope the blast radius of a compromised account across the attack window

ExtraHop’s Stop Credential Abuse page and the Accelerate Identity Threat Investigations with ExtraHop and Entra ID solution brief cover protocol decryption and identity correlation capabilities in depth. For a step-by-step walkthrough of Kerberos decryption in action, read Threading the Needle: Detecting AD CS Abuse Through Decryption.

Where common defenses fall short: Domain controller event logs are the usual source for spotting identity attacks, and native audit logs have limits. Reads of LAPS password attributes don’t generate events unless administrators configure directory service auditing on LAPS attributes. Verbose domain controller logs are expensive to forward, so many SIEMs receive only part of them, and an attacker with domain admin rights can clear them. Cloud identity protection services focus on cloud sign-ins, while ARTEX's delegation abuse and LAPS reads happen over on-premises Kerberos and LDAP. The Detect and Defeat AD Attacks with ExtraHop Decryption brief explains how RevealX reads on-premises Kerberos and LDAP exchanges directly.

5. Command-and-control and tunneling: threat context

VAPOR PANDA routed traffic through Tor, SOCKS proxies, and a compromised relay. The group tunneled traffic with Chisel and SoftEther and deployed the BLOODALCHEMY backdoor, which beaconed to attacker-controlled domains. Network context still exposes tunneling behavior, Tor connections and periodic beaconing, even when the payload stays encrypted.

Threat context builds on behavioral visibility by attributing suspicious infrastructure. CrowdStrike released BLOODALCHEMY command-and-control domains, and the South Korea campaign report lists proxy IP addresses. Matching traffic against threat intelligence in real time ties outbound sessions to known campaigns. RevealX’s Automated Retrospective Detection (ARD) automatically checks recent records when new indicators arrive, and analysts can search further back across retained records to find contact that predates publication. Related techniques appear in ExtraHop's analyses of VIPERTUNNEL and TerminalFix.

Where common defenses fall short: DNS filters, firewalls and secure web gateways catch command-and-control best once indicators are published. CrowdStrike published the BLOODALCHEMY domains on October 29th, 12 days after the VAPOR PANDA campaign began, and the domain names imitate ordinary database and web infrastructure. Chisel and SoftEther tunnels run over port 443 and resemble normal HTTPS to any gateway that skips TLS inspection. Tor connects to relay IP addresses directly, so DNS filtering sees little Tor activity, although firewalls with Tor relay lists fare better. Network context captures the tunneling and beaconing behavior itself, and its record store lets analysts search retained traffic for new indicators the day they appear (Automated Retrospective Detection).

Turning ARTEX workflows into detections

ExtraHop Reveal Labs continues to expand ARTEX detection coverage. RevealX now includes the Indicators of Compromise (IOC): ARTEX Domain Name detection, which flags HTTP, HTTPS, TLS or DNS requests to domains tied to ARTEX. Spotting those requests inside HTTPS traffic requires TLS decryption. Existing RevealX detections also cover the scanning, exploitation, credential abuse, lateral movement and tunneling stages described above, as cataloged in the ExtraHop Detection Library.

Other agentic frameworks and hands-on attackers use the same techniques, so a single detection does not confirm ARTEX. Stronger evidence comes from ARTEX indicator detections that coincide with an unusually high volume of workflow detections. For reconnaissance, review detections for TCP SYN scans and RDP connections to domain controllers. Then check the related inbound traffic for unusual User-Agent strings or headless browsers.

Customers can also write custom triggers that watch for specific ARTEX workflows. Strong starting points include:

• Inbound HTTPS requests whose XML or SAML bodies reference the cloud metadata address
• LDAP queries for LAPS password attributes from hosts that never made them before
• Kerberos S4U requests from newly created or unusual machine accounts
• Decrypted SMB file paths containing ProgramData\artx5v, a directory CrowdStrike tied to ARTEX activity
• Remote commands over WinRM or MS-RPC containing "artx" or "artex" strings
• Inbound scanning or exploit traffic with unusual or headless-browser User-Agent strings, arriving seconds apart

How network context strengthens EDR, firewalls, identity, and cloud tools

ARTEX attacks cross every layer of the security stack. Each control sees a separate layer of the intrusion, and ARTEX workflows are engineered to find the gaps left unmonitored.

Storm-0940 shows why the last row matters. Microsoft reports that Storm-0940 compromised a multi-tenant OAuth application, granted itself privileged cloud roles and read secrets in bulk from Azure Key Vault. OAuth abuse, role grants and Key Vault reads all run inside cloud provider APIs, out of reach of any network sensor. Identity security and cloud detection tools carry the primary detection load for that part of an attack. Network-derived evidence can demonstrate where the attack returns to the network, such as workloads accessed with stolen secrets, and through Entra ID context during investigations.

The strongest defense against AI-orchestrated attacks pairs NDR with EDR, identity and cloud controls. RevealX shares detections, records, and context with SIEM, SOAR, EDR, and MDR platforms through ExtraHop integrations, closing visibility gaps across every layer of the stack.

Machine-speed attacks need machine-speed defense

An attacker running dozens of AI agents in parallel will outpace a SOC working each alert by hand. Defenders are deploying defensive AI agents in response, and automated workflows require trustworthy context to reason over. Machine-speed defense requires structured, real-time records of asset, identity, behavioral, and threat activity. Power the Agentic SOC explains how agents use network context to triage and respond. Greg Clark lays out the operating model in The SOC Needs a New Operating Model, and Can You Trust Your Agent's Security Investigation? explains why verified context matters.

What should organizations do?

ARTEX systematically capitalizes on unpatched or misconfigured exposures, elevating foundational security hygiene from routine maintenance to urgent defense. CERT-EU and CrowdStrike recommend seven priorities:

1. Shrink the internet-facing surface. Expose only the assets that need exposure, and isolate management and control panels from the internet.
2. Patch internet-facing systems first. Prioritize appliances and long-lived Linux servers.
3. Fix low-severity findings too. ARTEX chains minor misconfigurations into serious attack paths.
4. Rotate keys and credentials after any suspected exposure. Include keys stored in old backups and directory exports.
5. Harden cloud identity. Enforce SAML signature validation, require IMDSv2 and limit which roles can run commands on instances.
6. Enforce MFA and watch privileged accounts. Alert on unusual administrator activity.
7. Map coverage blind spots. Identify every host without an EDR agent or network monitoring.

Key takeaways

• ARTEX is an open-source AI penetration testing framework now used by at least four threat actors, with 1,465 consoles exposed on the internet.
• AI orchestration adds parallelism, persistence, and a lower skill bar to familiar attack techniques.
• Every ARTEX workflow crosses the network, and network evidence exposes the speed, the decrypted payloads, the unmanaged hosts, the Active Directory abuse, and the command-and-control traffic.
• Cloud control-plane abuse, as seen with Storm-0940, calls for combining network visibility with identity and cloud security.

To learn how ExtraHop RevealX detects attacks that change faster than signatures, visit Defend Against Novel AI Attacks or schedule a demo.